p PatchFirst

CVE-2024-22206

CVE-2024-22206 · @clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR)

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Clerk helps developers build user management. Unauthorized access or privilege escalation due to a logic flaw in auth() in the App Router or getAuth() in the Pages Router. This vulnerability was patched in version 4.29.3.

CVSS 9.1 · Critical · EPSS 0.7% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • javascript

    Versions
    • >= 4.7.0, < 4.29.3: Affected

    No fix published

  • @clerk/nextjs npm

    Affected ranges
    • SEMVER: ≥ 4.7.0, < 4.29.3

    Update to 4.29.3

Original sources

Check your server →